Applicant 
Serial No. 
Filed 
Page 



Ulf Mattsson 
10/034,996 
December 28, 2001 
4 of 6 



Attorney's Docket No.: 17299-009001 



REMARKS 



Claim Amendments 

Claim 1 has been amended to correct a typographical error. The proposed amendment 
thus places the claim in better condition for appeal. 
Interview Summary 

The applicant thanks Examiner Fields for the phone interview held on April 11, 2006 
with Thomas A. Brown and Misha Hill. The examiner and the applicant discussed the applicant's 
arguments that the cited references fail to anticipate several elements of claim 1. These 
arguments are presented below. 
Section 103 rejection 

The applicant believes that the arguments presented in reply to the office action of July 1 , 
2005 are still applicable. The new grounds of rejection added a second reference, Sheymov, 
under 35 U.S.C. 103(a), but that reference was not alleged to supply all of the elements missing 
from the original reference, Roland. Thus, the new grounds of rejection do not render moot the 
original argument. 

In particular, Rowland does not describe and would not have made obvious "defining at 
least one intrusion detection profile . . . including a set of item access rates, one of which includes 
a definition of a number of rows that may be accessed in a predetermined period of time," as in 
claim 1 . The examiner seems to interpret this limitation as being met by the "profile ... of the 
days, times, and length of time that the user has logged in" (col. 5, 11. 21-23) and the "odd login 
time module" (col. 9, 11. 21-36). These elements of Rowland do not, however, correspond to the 
claimed invention. 

The profiles described in Rowland identify "the days, times, and length of time that the 
user has logged in" (col. 5, 11. 21-23), and use this to determine whether the current login attempt 
is consistent with the previous logins described in the "past data collected for this user" (col. 9, 
11. 22-23). The profiles do not identify a number of times anything, let alone rows of a database, 
may be accessed in a predetermined period of time. 

For the profiles in Rowland to be useful, they must have a sufficient sample size of 
previous logins. This is what Rowland is referring to by a "threshold number of user logins" (col. 
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5, 11. 23-24) and "the odd login time module 184 runs only after a predetermined amount of user 
logins have beerf collected" (col. 9, 11. 25-26). This does not refer to a limit on the number of 
logins. 

As argued in the previous reply, Rowland does not describe a database. Sheymov 
mentions a database, but does not describe and would not have made obvious "receiving a 
database query from a user" or "determining that execution of said query causes said user to 
exceed an item access rate" as in claim 1 . Sheymov describes "using hacker information stored 
in [a] database" as part of an intrusion detection system [0043], emphasis added). Using a 
database to detect system intrusions is not the same as "determining that execution of [a 
database] query causes [a] user to exceed an item access rate," as required by claim 1. 

Neither Rowland, Sheymov, or their combination include all the elements of Claim 1. 
Further, even if Sheymov includes accessing a database, its combination with Rowland would 
not have made obvious "determining that execution of [a database] query causes [a] user to 
exceed an item access rate," because both Sheymov and Rowland describe securing a system^ 
and neither suggests either securing a database or using item access rates to secure anything. 

The dependent claims are allowable for at least the same reasons as the claims on which 
they depend. 

The applicant requests that the rejection be withdrawn and the claims found patentable. In 
the event that the rejection is not withdrawn, the applicant requests that the amendment to 
claim 1 be entered in accordance with 37 C.F.R. 1.1 16(b)(2) to place the claims in better form 
for consideration on appeal. 

No fees are believed due at this time. Please apply any charges or credits to deposit 
account 06-1050. 
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